Aetna, Inc.

Aetna, the covered entity (CE), reported that a business associate (BA), Real Time Health Quotes LLC, an insurance producer was using an unsecured cloud storage application to store protected health information (PHI). Aetna determined 1,506 individuals were affected by this breach. The protected health information included names, dates of birth, Social Security numbers, medical histories, as well as bank account and credit card information. As part of an investigation, OCR reviewed the CE’s business associate agreement with the BA. The CE provided breach notification to HHS, the media, affected individuals, offered the affected individuals free credit monitoring and terminated its relationship with the BA. Additionally, the CE is conducting a review of cloud storage application use among its other similar BAs and will provide training to any that use these applications.